Analysis
- max time kernel
99s - max time network
136s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
18/08/2026, 15:01
Behavioral task
behavioral1
Sample
2026-08-18_61d30e7a82561f47d8d977b8a8ed6e28_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-18_61d30e7a82561f47d8d977b8a8ed6e28_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-18_61d30e7a82561f47d8d977b8a8ed6e28_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 868KB
- Sample260818-sd3ecacq61
- SHA256 7e63f5bf1b81258c2d3ff78efe30fda4dd5ff38b56ab477affd59ffac0ea085c
- MD5 61d30e7a82561f47d8d977b8a8ed6e28
- SHA1 a453263cbf1412cfc8b0cb0cc60ce859e216203b
- SHA512 eefb9b3df8b6ab3788a15324abe9065ee6f1515b1d78984ec7fcce2ff81d5a76200320cfdbce44046312dd63e4cb3d50d5fb096c2b24256d844ec75da95f9f1c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasaEp:A3k03kB56r7
- TLSH T1B3156A17E6840FA4D10FC1749A968662EA737C025F2097DF1358AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 48 IoCs
resource yara_rule behavioral1/memory/3596-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024340-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2416-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000001e697-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3596-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2416-23-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000001e6e7-42.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002161f-61.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0004000000023442-170.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000023454-245.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021277-270.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021272-409.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002127b-482.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002127c-507.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002127d-592.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002127e-623.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021280-649.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002127f-729.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021281-748.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021282-779.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021284-804.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021285-835.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021286-860.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021287-879.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021288-898.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021289-905.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002128b-919.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002128c-933.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002128d-946.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000800000002433d-965.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002128e-1020.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021290-1057.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021291-1076.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021292-1101.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021293-1133.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021294-1152.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021295-1184.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021296-1191.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021298-1198.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021297-1235.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021299-1338.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002129a-1345.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002129c-1358.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002129f-1389.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x001e00000002025b-1564.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000006ff-1857.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000000735-1912.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00060000000162bc-2003.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0007000000024340-6.dat aspack_v212_v242 behavioral1/files/0x000300000001e697-12.dat aspack_v212_v242 behavioral1/files/0x000300000001e6e7-42.dat aspack_v212_v242 behavioral1/files/0x000200000002161f-61.dat aspack_v212_v242 behavioral1/files/0x0004000000023442-170.dat aspack_v212_v242 behavioral1/files/0x0003000000023454-245.dat aspack_v212_v242 behavioral1/files/0x0003000000021277-270.dat aspack_v212_v242 behavioral1/files/0x0002000000021272-409.dat aspack_v212_v242 behavioral1/files/0x000200000002127b-482.dat aspack_v212_v242 behavioral1/files/0x000200000002127c-507.dat aspack_v212_v242 behavioral1/files/0x000200000002127d-592.dat aspack_v212_v242 behavioral1/files/0x000200000002127e-623.dat aspack_v212_v242 behavioral1/files/0x0002000000021280-649.dat aspack_v212_v242 behavioral1/files/0x000300000002127f-729.dat aspack_v212_v242 behavioral1/files/0x0002000000021281-748.dat aspack_v212_v242 behavioral1/files/0x0002000000021282-779.dat aspack_v212_v242 behavioral1/files/0x0002000000021284-804.dat aspack_v212_v242 behavioral1/files/0x0002000000021285-835.dat aspack_v212_v242 behavioral1/files/0x0002000000021286-860.dat aspack_v212_v242 behavioral1/files/0x0002000000021287-879.dat aspack_v212_v242 behavioral1/files/0x0002000000021288-898.dat aspack_v212_v242 behavioral1/files/0x0002000000021289-905.dat aspack_v212_v242 behavioral1/files/0x000200000002128b-919.dat aspack_v212_v242 behavioral1/files/0x000200000002128c-933.dat aspack_v212_v242 behavioral1/files/0x000200000002128d-946.dat aspack_v212_v242 behavioral1/files/0x000800000002433d-965.dat aspack_v212_v242 behavioral1/files/0x000300000002128e-1020.dat aspack_v212_v242 behavioral1/files/0x0002000000021290-1057.dat aspack_v212_v242 behavioral1/files/0x0002000000021291-1076.dat aspack_v212_v242 behavioral1/files/0x0002000000021292-1101.dat aspack_v212_v242 behavioral1/files/0x0002000000021293-1133.dat aspack_v212_v242 behavioral1/files/0x0002000000021294-1152.dat aspack_v212_v242 behavioral1/files/0x0002000000021295-1184.dat aspack_v212_v242 behavioral1/files/0x0002000000021296-1191.dat aspack_v212_v242 behavioral1/files/0x0002000000021298-1198.dat aspack_v212_v242 behavioral1/files/0x0003000000021297-1235.dat aspack_v212_v242 behavioral1/files/0x0002000000021299-1338.dat aspack_v212_v242 behavioral1/files/0x000200000002129a-1345.dat aspack_v212_v242 behavioral1/files/0x000200000002129c-1358.dat aspack_v212_v242 behavioral1/files/0x000200000002129f-1389.dat aspack_v212_v242 behavioral1/files/0x001e00000002025b-1564.dat aspack_v212_v242 behavioral1/files/0x00030000000006ff-1857.dat aspack_v212_v242 behavioral1/files/0x0003000000000735-1912.dat aspack_v212_v242 behavioral1/files/0x00060000000162bc-2003.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2416 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-18_61d30e7a82561f47d8d977b8a8ed6e28_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-18_61d30e7a82561f47d8d977b8a8ed6e28_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-08-18_61d30e7a82561f47d8d977b8a8ed6e28_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-08-18_61d30e7a82561f47d8d977b8a8ed6e28_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-08-18_61d30e7a82561f47d8d977b8a8ed6e28_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe$ patcher.exe File created C:\Program Files\7-Zip\Uninstall.exe 2026-08-18_61d30e7a82561f47d8d977b8a8ed6e28_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-08-18_61d30e7a82561f47d8d977b8a8ed6e28_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-08-18_61d30e7a82561f47d8d977b8a8ed6e28_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-08-18_61d30e7a82561f47d8d977b8a8ed6e28_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-08-18_61d30e7a82561f47d8d977b8a8ed6e28_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe$ 2026-08-18_61d30e7a82561f47d8d977b8a8ed6e28_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-08-18_61d30e7a82561f47d8d977b8a8ed6e28_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-08-18_61d30e7a82561f47d8d977b8a8ed6e28_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe 2026-08-18_61d30e7a82561f47d8d977b8a8ed6e28_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe 2026-08-18_61d30e7a82561f47d8d977b8a8ed6e28_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$ 2026-08-18_61d30e7a82561f47d8d977b8a8ed6e28_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-08-18_61d30e7a82561f47d8d977b8a8ed6e28_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-08-18_61d30e7a82561f47d8d977b8a8ed6e28_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe$ 2026-08-18_61d30e7a82561f47d8d977b8a8ed6e28_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE$ 2026-08-18_61d30e7a82561f47d8d977b8a8ed6e28_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-08-18_61d30e7a82561f47d8d977b8a8ed6e28_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-08-18_61d30e7a82561f47d8d977b8a8ed6e28_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-08-18_61d30e7a82561f47d8d977b8a8ed6e28_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe 2026-08-18_61d30e7a82561f47d8d977b8a8ed6e28_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe 2026-08-18_61d30e7a82561f47d8d977b8a8ed6e28_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe 2026-08-18_61d30e7a82561f47d8d977b8a8ed6e28_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe$ 2026-08-18_61d30e7a82561f47d8d977b8a8ed6e28_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe 2026-08-18_61d30e7a82561f47d8d977b8a8ed6e28_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{87EB8AE8-DCC9-4923-8C88-7CEABF61AB19}\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 2026-08-18_61d30e7a82561f47d8d977b8a8ed6e28_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe$ 2026-08-18_61d30e7a82561f47d8d977b8a8ed6e28_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-08-18_61d30e7a82561f47d8d977b8a8ed6e28_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe$ 2026-08-18_61d30e7a82561f47d8d977b8a8ed6e28_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-08-18_61d30e7a82561f47d8d977b8a8ed6e28_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-08-18_61d30e7a82561f47d8d977b8a8ed6e28_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe$ 2026-08-18_61d30e7a82561f47d8d977b8a8ed6e28_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe 2026-08-18_61d30e7a82561f47d8d977b8a8ed6e28_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE 2026-08-18_61d30e7a82561f47d8d977b8a8ed6e28_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe 2026-08-18_61d30e7a82561f47d8d977b8a8ed6e28_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-08-18_61d30e7a82561f47d8d977b8a8ed6e28_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe$ 2026-08-18_61d30e7a82561f47d8d977b8a8ed6e28_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{87EB8AE8-DCC9-4923-8C88-7CEABF61AB19}\MicrosoftEdge_X64_139.0.3405.125.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-08-18_61d30e7a82561f47d8d977b8a8ed6e28_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-08-18_61d30e7a82561f47d8d977b8a8ed6e28_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-08-18_61d30e7a82561f47d8d977b8a8ed6e28_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-08-18_61d30e7a82561f47d8d977b8a8ed6e28_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe 2026-08-18_61d30e7a82561f47d8d977b8a8ed6e28_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe 2026-08-18_61d30e7a82561f47d8d977b8a8ed6e28_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-18_61d30e7a82561f47d8d977b8a8ed6e28_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-18_61d30e7a82561f47d8d977b8a8ed6e28_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3596 2026-08-18_61d30e7a82561f47d8d977b8a8ed6e28_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 2416 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-18_61d30e7a82561f47d8d977b8a8ed6e28_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-18_61d30e7a82561f47d8d977b8a8ed6e28_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3596
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2416
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 868KB
- SHA256 7e63f5bf1b81258c2d3ff78efe30fda4dd5ff38b56ab477affd59ffac0ea085c
- MD5 61d30e7a82561f47d8d977b8a8ed6e28
- SHA1 a453263cbf1412cfc8b0cb0cc60ce859e216203b
- SHA512 eefb9b3df8b6ab3788a15324abe9065ee6f1515b1d78984ec7fcce2ff81d5a76200320cfdbce44046312dd63e4cb3d50d5fb096c2b24256d844ec75da95f9f1c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasaEp:A3k03kB56r7
- TLSH T1B3156A17E6840FA4D10FC1749A968662EA737C025F2097DF1358AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 1.3MB
- SHA256 1676ff7a4d64492d843b077bc2fcaaea06e17640d9dc1a0b7cfb7641bd00c763
- MD5 dc07372fa205bff0de59a4bf5604fd5a
- SHA1 d52ab9f6997404b29ea4b93a2e68a2740db41f5e
- SHA512 d04d8d4bb426f9f83b81a0b95e81daf3b7e34a795a308b2afbe0e317bbc63733db993cf74f4c5dc1e99f193bfe25f2136e9e1e33228f8f0b56a9e0f1764fa16e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasaEJ3Td9CHKy7GZO:A3k03kB56r7Td9CHKyao
- TLSH T178557C12E7D40EE4E06FC13499A64522EA777C561F209BCF1354AE153F32BD0AA39B63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe
- Size 967KB
- SHA256 fb6b97388a9887398d815d5ef85027bd243ed1eba75b9f4aba6d12c540f7b6f4
- MD5 d4f8a0681075743c5023ca4a427e2c54
- SHA1 5432866159d3f93730215ee5639b5a67615b9845
- SHA512 08758d7345616e04895b9d751695019ceded4489fe6c84bf60c4599c1f268514781cfa87b9e8361b7343b6d775a2df0eaed2a3a39445b486385f14291c48cdb3
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasaEJUwjBXG:A3k03kB56rQwFXG
- TLSH T18F257C03E6840FA4D11F81349A958972EA77BC125F2097DF2354AE253F32BD0AB3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe
- Size 967KB
- SHA256 daa24a7eb6779b908e688f14a34eedaca2a3d08387a0863ec36f57873cf7aeb6
- MD5 ef2a3ec89dc5a266c92471559e68505a
- SHA1 aa8942c1f8aabd091a8249bdd237be0047894462
- SHA512 a6f795ceb630c147cb7308821dfe6624051a6619abfd036cffe7245838bed1cb3fa612ad7ff449faae3f0db1ee36dcb4653ccac85a224212c547791cb0f5924b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasaETbBPzBAU:A3k03kB56rxBPVAU
- TLSH T165257C13E6840FA4D11F81349A958A72EA777C121F2097DF2354AE253F32BD0AB3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe
- Size 969KB
- SHA256 6655d52dbc40248214cfd0343f3c73c0192bbe7d03e27badf3c43840e06581ea
- MD5 1ce6fb0154658960433ae33888c551d4
- SHA1 b579aaa5bebbaaf506b14c970e934e8b31612b33
- SHA512 a9da60f0085fe5f34dd08d8c72ed1b9c34bc9e0017fc7750eca31314ec095e6d93bca824d8ef3897329656f5b9211276ec7de6b969e9c28f7cf87a5c499a55ab
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasaEUT6Nr:A3k03kB56rqTAr
- TLSH T166256B03E6940FA4D11F81749AA68672EA737C125F2097CF1354BE153F72BD0AA3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 977cb872e05e90f9fef058505680c041f6ae1d9f96e54c8698dbd46d20170fbc
- MD5 de6becb74157406608560c90297a561f
- SHA1 738f5e23437b2ac005357c41bdb5bded005c7362
- SHA512 1bd9462421e98dbc4a4e2e186ab443aaa3212aeb90aa898c7fde23f98ed244c966a0a27c54e4060eec84de29721fe74c016d42c8595e2bc39f8815e259cf26ec
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasaEV0Le5ji0hmxNrM:A3k03kB56rnPji0Aj
- TLSH T1BD654A16F6A44B65D02BC074C5D2966AEA733C421F3087CB1354EE283F67BD19A3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 883KB
- SHA256 7087cee4d92e81d76ddc30390f516b969ac0da16e95420736e9ba4e21240954d
- MD5 9b81de709f6c1f9c0d4c7d3baccfa579
- SHA1 b4ebb07a53056a62bfa2bb1d3629295b49e83987
- SHA512 11fa5c1bedddfa53c7997d93a7f4953e5d85f16eb53cf28b494ae50629b06b4c8963c7dad0c36ea7e5323d40e5bafcebf14065c734bd2d0e2872931892a84922
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasaE3a:A3k03kB56r
- TLSH T13E156B13E6840FA4D10F81749A968A62EA737C125F2097DF1354AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 916KB
- SHA256 8151d47d48264ddb007cb5d364d9062bab1173078bd770d245943480d456bd77
- MD5 4f0be30cb845c912f87f1bc21203fea1
- SHA1 58ac4d582f54943e3ab17c3fda5853a89d434086
- SHA512 13fc2e19d82d5476a71f3eb98c36044f9acea88970c395bd83f622f0eb7b9c4c7ca4740b0ef84af97e70e7131846657d57a2310b1b2ebb0d5e94418397a0b108
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasaE0b:A3k03kB56rqb
- TLSH T1FB157B03E6840FA5D11F81749AA58672EA777C421F2097DF1358AE153F72BC0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$
- Size 1012KB
- SHA256 77f032c8353024484123bbc95965c0b9a710025fdd7636bfe890e9c5f6c57778
- MD5 2f8d6db30bc6ed6c0d002b44f1d42ee3
- SHA1 24978c8c4d5a73f73d615cea656b520aa50b39fc
- SHA512 71dec5f4849ebfdf2861223182defdfb3aebbf3b19c6735e8177cd23cfa9db4ceb48fcd43b17041cfcb166839772a1be0b5fa2b49298f44685d436f8fbc55bcc
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasaEuD:A3k03kB56rg
- TLSH T164252606E6840EA4D01F8174DB958662F6737C125FE093CB13D4EE3D3F72A906AEA257
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 892KB
- SHA256 a7cb92af2ad78c4d7d741df4ddce4cc6f38b442e87fc35419f6c713e1f87caae
- MD5 7f487c6f3af12b6d7baf125cf5cbcf21
- SHA1 2f0d76fe24d75eb10c389a48f546e71c36237a74
- SHA512 b778928134dcb6632f9246bc33e810ff2f26a7a27b5a8b508e656db0672336db467be18a15f382ed50212d07c8ddc48be97e9fc091ee4e5fec8332edba83be3d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasaE26:A3k03kB56rv
- TLSH T1C4156B13E6840FA4D10F81749A968662EA777C125F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 892KB
- SHA256 ef27593ef16cbe147b1f07841b25a5c6003f35f19a7136d76ef06959a85f89f0
- MD5 c6f75cd5fa641c4d423358d87ef6505c
- SHA1 c669e3257933c6223aeb0b339fdc161d006886bf
- SHA512 174b9cbae7713a0b44a338371111f9d68cedc3169cba6a162ee5d0aa58f188ac92b3f5d19eb920af7a3ca0f685bfbd94eea5aa50c76e7da8338e1017907e31c9
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasaEOo:A3k03kB56rP
- TLSH T17A156B17E6840FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 892KB
- SHA256 54d7dd2211befb06a78557e1b1884c46edc3823e22371d0b253d803e30ee12f9
- MD5 2a220f4432afe276b530b8c9357b3153
- SHA1 266567b6e0740cff9e58b8da786e57165b89795e
- SHA512 f689477cb73b90097fb6bead779e0301b41cd6980143fced1d11b4f62828fbb50b19e323538f6d51ee1e81c81d413425fc740b12e85d3fb8d466f74b45954a2c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasaEiu:A3k03kB56rB
- TLSH T14F156B17E6840FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 892KB
- SHA256 0ecdba6e466696882f06596d522851e56acc7221c3355cd39a2d69a40ee7c2d6
- MD5 886ef867dc030fb9ea30270dacd6b7b7
- SHA1 949d43861d5a3c9f7b3f7ffa513e24f2f739bf5f
- SHA512 65f71ca7e97752e4328ebbaff15bfda533fa09e5c56af9fa786c8f7c21e3394f07007fe7710c3b04445321fccea1cb0bf252d96143384a50532f93592f9ff54d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasaE29:A3k03kB56r8
- TLSH T127156B13E6840FA4D10F81749A968662EA777C025F2097DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 892KB
- SHA256 8364c25cf0b1438c84ff59f1164ebf259c0a1ff77a9b7325598f93550cbfa59c
- MD5 a148983ea349ef617e472440763d77e2
- SHA1 5774ec6f2542b96e2b579d73e2b75c7b51f7a134
- SHA512 e84804310e84cbfa622c8690fa46d5ed0b463c2d019ad4488dfc3885ee9908f5ea2823f50b0199f0e2703c0ce33be8115a30a45e202094cfd0af5350829dc394
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasaE2c:A3k03kB56r1
- TLSH T193156B13E6840FA4D10F81749A968662EA777C025F2097DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 892KB
- SHA256 ec0af6572f8bc16a14266b7bf8508992f7c2d84623bd5f92a44adbbdb37dc29c
- MD5 1646b18300bd3049e4f59a6258fddc53
- SHA1 800dba5d068d891dd1a3d9d0fb970cc494fd61a7
- SHA512 669ccf9930b18cd4fcbc69aaf3013eac0967cdeead70918aa4b051dfb63a4aee60721247de328c5f67e47b8943dbf470e77d337dc6ed6964ee1bfbf1f442f199
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasaEvp:A3k03kB56r7
- TLSH T11F156B13E6840FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 892KB
- SHA256 728838a081251592224a413d9680f3ccfa4aa3c390ec34c14897bbf37dcac9b7
- MD5 ef04c5090574372c7d78ba07d21efe9b
- SHA1 c36806d9843533c0d4e34ef92b537926df09256d
- SHA512 eb457041dc51f7ce7e026588e65dfc670dc42f6fd69d971e83e37503881175a0664c5e223207742e35bd4dd194f99ca2c57a8d988b3e54d1089401ce264ba83f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasaEQN:A3k03kB56rA
- TLSH T17D156B17E6840FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 892KB
- SHA256 5fa8cb5f6204333023a127388ddfb222cd18e83005452571cdcfb10d02a299ff
- MD5 a313ac5ba0b1aa50a328718566e6c674
- SHA1 91e152ca5e234e6417cd2510b5b6005335f3f512
- SHA512 4c1bd719433d35b436a405dc7faa39065e8d4f8d2f2bf79b0c1bbeab865d8b1072dbc537fe62c53a7d440a3d86410ecd1e2766489d418f1ae2f9255af27b3eb9
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasaEYF:A3k03kB56r2
- TLSH T18C156B13E6840FA4D10F81749A968662EA777C025F2097DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 892KB
- SHA256 90cd571eba7275d1304c32200402777968d239a59d5c6805fbfbde4f5af4f498
- MD5 4cdf9d9b46e75109070ccc9a8f3be8c4
- SHA1 dc925d3fa1d90461a4e6101447bb5ec2136c859c
- SHA512 487dd660dc0ac218d9754adc4d3085591533abb22248142f2d8c23967a98259a8e53f89c0bc3de762bd3a7ca4fd618017705f5478b270e2c3fffdf4761549362
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasaENC:A3k03kB56ry
- TLSH T1CF156B17E6840FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 892KB
- SHA256 02dedb160934a9b816666499a4d618abd8576a01239fbb51f5ad546d70ff9f36
- MD5 b5f60f8c907afa87f04483f22cb74b67
- SHA1 7e61fb79ccfcfa2e2c2e25b373cb8e6b35069295
- SHA512 78f3af59c04e1ffa545306cbd147841e084a695eeec8c06fa46f7efec4a5fde9956756c731ebfa0898e360302331d79fd3c737e3db2189cff480438ac3e0f187
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasaE2w:A3k03kB56rH
- TLSH T1D4156B13E6840FA4D10F81749A968662EA777C025F2097DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 892KB
- SHA256 fe26370423b38a05f30e65b982deff10568344ad49fdc93fe40a754d9a21a6f1
- MD5 33482010cbfd0e1a68cdfc6d56062e7e
- SHA1 6444835f9f4f90467ab09b657cacb2e5ba0162d7
- SHA512 6246a21cfa1df8f52f9c6e24540618cf7cdb687bb3114b46b4a0c5318404963e88c605d6112d2183114bdbb5ff6e1819f79a3c9e540825dd291e7fbdcb870748
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasaElT:A3k03kB56rD
- TLSH T156156B13E6840FA4D10F81749A968662EA777C025F2097DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 892KB
- SHA256 76ba1a3d09a111a5cdb799ae67a080346a6ced6e2b7f20f392103ecd8eb963c0
- MD5 3be8a5df395613f3a60a36c7dc706d6a
- SHA1 9e1a9b045b0015035dab71b05a6be500fa46c7e6
- SHA512 527f94072bf3ee5e2582ad3765b8358d99f5b592511bbeda573763f7bf2952111d7d5d32d76610d137b3a59c3a2a8131044ba2d0d321d1944e2d4a7b466c8229
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasaE7u:A3k03kB56r0
- TLSH T193156B13E6840FA4D10F81749A968662EA777C025F2097DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 892KB
- SHA256 d488b508faef103dc5c0fca4a408f8e5f1012dc31eb0c1445897cd9d40141fad
- MD5 9d64e1b5c594c4a43532925961e8ab86
- SHA1 88e7d2ef30d61fd199ec21e7929582f150741660
- SHA512 8b3261effbd8c5b0ccac932f16182116079598aa32de278234aa8b845b8a71def7b0a18a1364bf4fbdd2faaffb97f787cba0341388376fdb20953fe4532e9392
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasaEfb:A3k03kB56rd
- TLSH T1EA156B13E6840FA4D10FC1749A968662EA777C125F2093DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 892KB
- SHA256 4658e1e5b6a758092fbb180a7259bd75ae6265bd3030ba04a3a402594d65d631
- MD5 60129408c3dfb359dce658510ca2da2d
- SHA1 e24456057684e3012f3b74809d0ed5622fef0a11
- SHA512 73677a7a4b928e0fb17a2c935b990fbe80718d269866b6f013fc596024e253559ae4de428de3a56093883d025ca561cea84303496159bd0dd9ef630899770fac
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasaEbf:A3k03kB56rN
- TLSH T145156B13E6840FA4D10F81749A968662EA777C025F2097DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 892KB
- SHA256 b96cbd6b24689bf9496b7a0b52b75f7304b837d97dd63fab39115ee7e3fa534e
- MD5 c2244f7e70f22ce901688522fe3e0f13
- SHA1 c3bc4f400c20c9550dfbf0d867445270c7902301
- SHA512 942330afd87a9e94c61ef609f8aff5dd2cd649ac395f2c7832312382bd01939c974b6027bd6f3a6587cf261863009cc9e3b0b2212e6d6d46559352dcb69a4312
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasaE0K:A3k03kB56rF
- TLSH T10D156B13E6840FA4D10F81749A968662EA777C025F2097DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 892KB
- SHA256 d4fd84754f439237e4adc15b8d2c64f014fcab9a3c29ef2142424001933f7e5e
- MD5 a6102b5d29927148d09b7c9fb0c9a159
- SHA1 64b2fb50d27d279609c36b6f8cfdb83fe0cb37db
- SHA512 2b9bffac52fc089ce92edea7d006625c0b6612702f5757c1f2c9328887032a6e3881b20dcbf619ed78ede1d64ec1a9444da417ff3ff53e8185e54540910a7c2a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasaEpk:A3k03kB56rs
- TLSH T108156B13E6840FA4D10F81749A968662EA777C025F2097DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 892KB
- SHA256 2c6e667690332f69b56f26286da4c0af04b0025b819a39d0cb808e046ef97785
- MD5 d46de02449ba5de6c2ade2a229ebcb48
- SHA1 6613da2f21ee5239635e45580e898f37d9f474b0
- SHA512 64ad6fe318ae5b70e95b303c8c4a72e71af581b6f44f251a018a9731e57607599c8cea15bd28b9fa5be7afb05524c798970e6cde24f5e7b312405caaca3d581a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasaEG0:A3k03kB56rF
- TLSH T1F6156B13E6840FA4D10F81749A968662EA777C125F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 892KB
- SHA256 3e8842a1d61654ade787bc86b1768906ed25981259770f6851f27b15e52350f9
- MD5 658e2eac1ab8df18d6f56f7977d2ef01
- SHA1 5b930faf467e8c2e48f83e9e523662b00e2a63ac
- SHA512 b235e2b8f8a40c360d852b21389b94028cb8701b3cef5bb7178d3e45513ded442fbbbd63cc4bd80bdb847d032c9f8925770e78f0bfe1a36048e031399b4f7100
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasaEVg:A3k03kB56rk
- TLSH T132156B13E6840FA4D10F81749A968662EA777C125F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 892KB
- SHA256 3a095c8b9641ee747e60589635eef1b6e9b7fea24abfb704286736a4e58eddf7
- MD5 e41159174ae3b8b5bc291fad0f27de28
- SHA1 45ee58aef40f4005c53ac2940026d7e416eb4d67
- SHA512 95d7ab175f09ec9b060d4951f275c0476cdf8d57ad9b8738ecb516c40538f195cec8c162553d14cc28b46b7fb4b78b40d39dcf0d00021663e40c3d15b18338f3
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasaEkr:A3k03kB56r2
- TLSH T171156B13E6840FA4D10F81749A968662EA777C025F2097DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 892KB
- SHA256 526fc7cb1f7ebaa94d7307fd1a33e37345c7fb9b98427d6c8f62e703e592372e
- MD5 e04d15a28c060f149d4ebaadb700fa5c
- SHA1 174a874eb5c249c0a1bdd90d625f1ede78dcfd74
- SHA512 552e12cbdffeec35ce159003ae5e5a4b9f3f590d73d93e211f4ab5c4e4f0f5a37590e1e744211d37cc2e6bae9107a1f413a23612621ced0e92f3521b4e9b423d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasaE6n:A3k03kB56rw
- TLSH T13D156B13E6840FA4D10F81749A968662EA777C025F2097DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 892KB
- SHA256 b9d777b91edce7e1b1c6fb4f2497a3fea8ca4bf972154e8cd93b0b6699da84cd
- MD5 78fe2afd49880999043e65303dc4ac1a
- SHA1 2f9d6249d89e0f96dbb715dac1e76deffa5f07d3
- SHA512 3bd4448e8b22e3f3504ddab7dfdfd80c6ca2fd87008eec0cfe7501f6448e483a3679b462e0266eb06160583ffcae7a41bcb43fc86d2ef6768980611a8c6d0e20
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasaEQx:A3k03kB56rW
- TLSH T1AA156B13E6840FA4D10F81749A968662EA777C025F2097DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 892KB
- SHA256 5ebb7b89dd1924040c655acdfc16a28e018ad1fbb1fe09bb2c5248231e1dacc0
- MD5 561ab99bd2abab18de2397a0771935fc
- SHA1 9ef19befdaa0ed6b6269672db16dc87deeb98d78
- SHA512 9acab3d9b547d7e3f7b7381a54fa17e317118a82df11e791e540a1645c73945d4133e52b764998f0a1b6d6e3466e51f1c8e1cf47e85d084ed5794fed6da5b597
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasaESA:A3k03kB56rN
- TLSH T1FC156B13E6840FA4D10F81749A968662EA777C125F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 892KB
- SHA256 36fa24fd83213dd73828752dd8d7fec742ce44906a51cdd275ae7ac40d6ade1e
- MD5 cb882b20e7c48452b519222e5aa2a2a4
- SHA1 233f5dc65af47f8538914066e671eac970beb218
- SHA512 ff0ec574dd239f7f7114350ea6aa876d61d7c9f852f93699173be4a4e5d2bbeb32663eda31e4041eae773a2fde714d9674a732c998d836d725f175ba86d53594
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasaEr9Q:A3k03kB56rc
- TLSH T1D4156B13E6840FA4D10F81749A968662EA777C025F2097DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 892KB
- SHA256 226bb291f8776878814b4c7abb6db14072de4175319a42c9e67dc56e732f2fcb
- MD5 bbc41b6656eeba7d31b6393d6d1b7a57
- SHA1 c166896c6a8a09221f32158b6788378ab90d9033
- SHA512 28359d24d7b7096f6259c1af1ff8637268a2cf088e0f30622f1628e96aba1835b29ba3ca2ead65055d356d34992fae2eb3657d3e01f5fcf923f7955cf81c958a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasaEa4:A3k03kB56r3
- TLSH T185156B17E6840FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 892KB
- SHA256 69ef2f228e92070d31c2176b4d24c039f18245fce23430ca9dc3ed303b132e89
- MD5 aac969f11ad0c5b4db2514d01be3eed1
- SHA1 becec88f4d0498dc6c39235c8ffb19222aca59db
- SHA512 831bf6e71605c6569ceb268e22cf143faee213bd9d56bd44c59104fbc3a6f5a646f36d905e54989e0659e99638c61fe340f0217c633208cf9a0c8cea02fda16d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasaEBu:A3k03kB56r6
- TLSH T10B156B17E6840FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 892KB
- SHA256 e5465b65e2d400025861e5b1d1738264b27b3176f9aa8a5d2398fdf6c41fbbf8
- MD5 a161fc08054efd8ad34101dba8917110
- SHA1 7788933dee23288427e2751e32c61ea12fb6d0a9
- SHA512 aa2da61f65e900c1b23d06c8d8e4c033a9bd8a8b1532ec053f3f6dffcf0f3479a8dd731f0992af5c8915508c28c32042be65dd549c3011971f9978607dd38c96
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasaE0j:A3k03kB56rU
- TLSH T133156B13E6840FA4D10F81749A968662EA777C025F2097DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 892KB
- SHA256 b6c20d387df36bbbf316a3d4890d3f6c8abed8a04fb3973ebb120fc4f3ba5fc0
- MD5 c7163933d5a5d6f2862e3d082981fb23
- SHA1 d8e22d9a26f86308c3d702a2d9b61a6b74a090cc
- SHA512 48d45c08665783704a232738cc79243b3e6d5c7a7f1b27e61c9c8b3e494f651e0afdf22b217a5c3299808ab2b950b4e04d859d483b94f064981502477440599d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasaE1g:A3k03kB56rc
- TLSH T14D156B13E6840FA4D10F81749A968662EA777C025F2097DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 892KB
- SHA256 7ecdd620ef8dda227f19b223a93c9591edce8a82f29ed958fe4ca6ead60db586
- MD5 e2a6fd29d6779948661f69b29b06d896
- SHA1 01109be315a48a6698dfeb24d4e52dd6fa790780
- SHA512 467c9ae2a68545e35e05b4b3e54f25b63321690dbedc391e54b38ae5667e68ecb24886089624ef4fbde5a3b9263ef88445dd65986a358d2bc80405412332d4e5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasaE0I:A3k03kB56r1
- TLSH T13C156B17E6840FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 892KB
- SHA256 cf50450efae1f8a2ba0b856e3e65a6527bdef193659a3a47a23c79ab612359d6
- MD5 61a176bde644aa4d72caac5ba92b41a7
- SHA1 0310fa513d0baf75911efffbbd99726179ef6324
- SHA512 723ad5a9dd84ef07baa2d95d390d13e2c9cd72af03a2ddf3c028e5464ad4e9b1d37a0929e146383d31d13c805f00e60b464b75bdbe251f39113226bf89f894ee
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasaEmo:A3k03kB56rj
- TLSH T129156B13E6840FA4D10F81749A968662EA777C125F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 892KB
- SHA256 5227ae9d96fdd136a4ff71fc540f03942df46b8b90944c738cb894794e707639
- MD5 c6ab69dc021de9b2e3f4d1fa9c32cf96
- SHA1 f415d20bd9783b29363599b3ff3e24d9e225d50d
- SHA512 0b04d1ebaffd5e2aa7ddcd297a439da34c548f7637337b7c2c45b1a30bf08c0a1f7482fc4ba5bccc4259fea99e1dc2275d2e2be4b334892d0b211af2b43b0c14
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasaEN+:A3k03kB56rm
- TLSH T152156B13E6840FA4D10F81749A968662EA777C125F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 892KB
- SHA256 dcaf7070ddc9c7da228574273fe41c3865572ebe8e3c59cff228dd98833edc60
- MD5 176a8bfd29172d055b2681ecaffeb915
- SHA1 4f71ff29baa10a0b0bee480692dc4ffc41e8eeff
- SHA512 a433eef88384eaaee02548719567e7e18030396479968610692ceb986d11874a064dd826a7a86339ccea45e3e2d4f62c557b1f830be58c364b7b8391e922e7f6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasaE7Q:A3k03kB56ri
- TLSH T12E156A17E6840FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 892KB
- SHA256 4ba229ef47a7e5357ccc209eb263f8bab6eacce0f8768f90a2ac179d0e1f394f
- MD5 2b26e0fda8703600ebb5d48191dc0dc0
- SHA1 a115fc8abe6395f80bb9e98c2df364e5b3e79bdf
- SHA512 e75f6cef20500601cd646cf124d4c768467c00718d26f2856aa65f1291db4fd817c44844667b14f8048bb5624f975f24fd311528aac37da3d42050c41d5bd096
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasaEwX:A3k03kB56ry
- TLSH T181156B13E6840FA4D10F81749A968662EA777C025F2097DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 892KB
- SHA256 ddd766e3187b30de18ccc7bf8c167e69ac1b986b2d51e70a102ccdc3180d4a5c
- MD5 004375b4ab9a455d1af112eedb8afd55
- SHA1 b1120f44eb797d237f00533e522570cd8a506331
- SHA512 b9c25f817a31b95b41936014f29d8112e178aea18ee103160f69984688aaa7a6f031e58f5d751ba9bf649895b14db3fa9fc532073fad9d63ace53e4ccd889212
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasaEGL:A3k03kB56rc
- TLSH T1C6156B13E6840FA4D10F81749A968662EA777C025F2097DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 892KB
- SHA256 7910c33232a182092af7887b315043af8923e7d32b56802828803315bf461c2b
- MD5 7db43129026305ce3c7db0ccd7fc32e4
- SHA1 6153470c90dfdf4a910bbe83591778b70ef7b284
- SHA512 19a08a56d40a90132c942c5756208980cc5fb14d7a645d73d3d4553f5c421f2f329529c874c8b3d4e6322affa5ee34256fb8e47f440a03a2241a66ece49dcab0
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasaEaM:A3k03kB56rt
- TLSH T1DB156B13E6840FA4D10F81749A968662EA777C125F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 892KB
- SHA256 22fc1ddcf7d0f7ca7c8c3675a0eefe16ebd362acdf5c85075a5fa5dada777ffd
- MD5 c31c8cfe168308aba738a975b51fc40d
- SHA1 4a97e351780c1f0baebea1c4d739fc0b02acd8bc
- SHA512 ccd8ca99b6eee2c4f4dee71145dabe22f1c950b026ea48052aed2a068298089b15b9aa693d9fe8186851026ccb8dfb6633e442b484cdff2a724338e9adae4e6b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasaELh:A3k03kB56rH
- TLSH T127156B13E6840FA4D10F81749A968662EA777C025F2097DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH